Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
12/05/2024, 05:14
Behavioral task
behavioral1
Sample
6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe
- Size 247KB
- Sample240512-fxfngadf49
- SHA256 4b27d5561b3e5ec30bc0557d628bdb3086f925f6787d05b5af51e40e11751252
- MD5 6f4fe5060abc6aca803ae6a944a45330
- SHA1 37071f614969b3df64439043b84f26f3daedf5b0
- SHA512 d828f88f6523b1ebfbc6fbbe9761207e1c7a447da56c1561e846efd4c2b29580733af3b1af1c0917c873ddd39a1a1707cd1742b0b42771b6fc64c9b673a65c74
- SSDEEP 3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+3:ccm4FmowdHoSi9EIBftapTs4WZazW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1116-1-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3068-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2736-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2752-64-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2692-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3028-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1668-150-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1492-167-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1952-133-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2860-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1228-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1768-177-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2548-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2768-46-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2160-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2104-16-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2616-186-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2908-203-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2508-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1844-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/992-249-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1536-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1028-289-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/888-308-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3048-322-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2208-337-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2932-382-0x00000000001C0000-0x00000000001F6000-memory.dmp family_blackmoon behavioral1/memory/2628-413-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2892-426-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/588-484-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2380-552-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2164-559-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/284-566-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2916-682-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2824-720-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/600-789-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2412-1032-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x00090000000120ff-5.dat family_berbew behavioral1/files/0x0033000000016c56-17.dat family_berbew behavioral1/files/0x0008000000016ce7-26.dat family_berbew behavioral1/files/0x0007000000016d3d-44.dat family_berbew behavioral1/files/0x0007000000016d45-54.dat family_berbew behavioral1/files/0x0008000000016d65-71.dat family_berbew behavioral1/files/0x0005000000018686-79.dat family_berbew behavioral1/files/0x00050000000186f1-97.dat family_berbew behavioral1/files/0x00050000000186ff-107.dat family_berbew behavioral1/files/0x0005000000018739-114.dat family_berbew behavioral1/files/0x000500000001873f-124.dat family_berbew behavioral1/files/0x0005000000018787-132.dat family_berbew behavioral1/files/0x000500000001878d-141.dat family_berbew behavioral1/files/0x0006000000018bf0-148.dat family_berbew behavioral1/files/0x000500000001923b-166.dat family_berbew behavioral1/files/0x0005000000019228-158.dat family_berbew behavioral1/files/0x000500000001925d-175.dat family_berbew behavioral1/files/0x0005000000019260-183.dat family_berbew behavioral1/files/0x00050000000186e6-89.dat family_berbew behavioral1/files/0x0007000000016d4e-62.dat family_berbew behavioral1/files/0x0008000000016d2c-36.dat family_berbew behavioral1/files/0x0005000000019275-193.dat family_berbew behavioral1/files/0x0005000000019277-201.dat family_berbew behavioral1/files/0x0005000000019283-211.dat family_berbew behavioral1/files/0x000500000001933a-219.dat family_berbew behavioral1/files/0x0034000000016c71-231.dat family_berbew behavioral1/files/0x0005000000019381-238.dat family_berbew behavioral1/files/0x000500000001939f-247.dat family_berbew behavioral1/files/0x00050000000193a5-257.dat family_berbew behavioral1/files/0x00050000000193b1-265.dat family_berbew behavioral1/files/0x0005000000019433-274.dat family_berbew behavioral1/files/0x000500000001943e-281.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 2104 hbnntt.exe 3068 pjddp.exe 2160 fxrflxl.exe 2736 lffflxr.exe 2768 5thbhh.exe 2792 pjpvj.exe 2752 vvpjv.exe 2692 9rlrlrx.exe 2548 btnnhn.exe 3028 tnbbnt.exe 1228 dvjvj.exe 2784 fffrxlx.exe 2860 9xlrflx.exe 1572 tnhtnb.exe 1952 djjdj.exe 2428 ffrfxlf.exe 1668 bnbnnb.exe 776 djppd.exe 1492 ffxflrf.exe 1768 lflxxlr.exe 2616 3ttbhh.exe 1248 pjdjp.exe 2908 ffxrfrf.exe 2508 tnnbht.exe 1844 hhhnth.exe 2420 1lxlxlx.exe 1160 tnbhnt.exe 992 dvpvp.exe 1536 jjvvp.exe 2008 1rlrffr.exe 1032 bbhhtt.exe 1028 jpdvd.exe 3012 flfxrlr.exe 2488 bbhtnn.exe 836 jddjj.exe 888 rllxlxf.exe 3048 fffrxlx.exe 1592 bhbtnh.exe 1432 jppjj.exe 2208 rrfrxxl.exe 1164 9bnnbh.exe 2756 pdjvv.exe 1044 lfxrfxx.exe 2284 ttnbnb.exe 2564 nnthbh.exe 2932 vvvvj.exe 2696 lffrxxf.exe 2076 hbtnbh.exe 3036 tttntn.exe 300 djpdj.exe 2716 7flrllx.exe 2628 frxllrr.exe 2856 bnnbtb.exe 2892 jjvdj.exe 1800 dvvdj.exe 2832 nbhhhn.exe 2472 tbbnht.exe 2836 jjvpv.exe 1796 3rlffxf.exe 264 rrllrff.exe 1636 btbnbh.exe 1332 1dpdp.exe 588 vvvdj.exe 1200 1rflxfl.exe -
resource yara_rule behavioral1/memory/1116-1-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00090000000120ff-5.dat upx behavioral1/memory/2104-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0033000000016c56-17.dat upx behavioral1/memory/3068-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000016ce7-26.dat upx behavioral1/files/0x0007000000016d3d-44.dat upx behavioral1/memory/2736-38-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000016d45-54.dat upx behavioral1/memory/2752-64-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000016d65-71.dat upx behavioral1/memory/2692-72-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000018686-79.dat upx behavioral1/memory/3028-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000186f1-97.dat upx behavioral1/files/0x00050000000186ff-107.dat upx behavioral1/files/0x0005000000018739-114.dat upx behavioral1/files/0x000500000001873f-124.dat upx behavioral1/files/0x0005000000018787-132.dat upx behavioral1/files/0x000500000001878d-141.dat upx behavioral1/files/0x0006000000018bf0-148.dat upx behavioral1/memory/1668-150-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1492-167-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001923b-166.dat upx behavioral1/files/0x0005000000019228-158.dat upx behavioral1/memory/1952-133-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2860-116-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1228-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1768-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001925d-175.dat upx behavioral1/files/0x0005000000019260-183.dat upx behavioral1/files/0x00050000000186e6-89.dat upx behavioral1/memory/2548-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000016d4e-62.dat upx behavioral1/memory/2768-46-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000016d2c-36.dat upx behavioral1/memory/2160-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2104-16-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019275-193.dat upx behavioral1/memory/2616-186-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2908-203-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019277-201.dat upx behavioral1/files/0x0005000000019283-211.dat upx behavioral1/memory/2508-213-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001933a-219.dat upx behavioral1/memory/1844-220-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1844-224-0x00000000001B0000-0x00000000001E6000-memory.dmp upx behavioral1/files/0x0034000000016c71-231.dat upx behavioral1/memory/1844-229-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019381-238.dat upx behavioral1/memory/992-249-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001939f-247.dat upx behavioral1/files/0x00050000000193a5-257.dat upx behavioral1/memory/1536-256-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1536-264-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000193b1-265.dat upx behavioral1/files/0x0005000000019433-274.dat upx behavioral1/files/0x000500000001943e-281.dat upx behavioral1/memory/1028-289-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/888-308-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3048-315-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3048-322-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1432-329-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2208-337-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1116 wrote to memory of 2104 1116 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe 28 PID 1116 wrote to memory of 2104 1116 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe 28 PID 1116 wrote to memory of 2104 1116 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe 28 PID 1116 wrote to memory of 2104 1116 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe 28 PID 2104 wrote to memory of 3068 2104 hbnntt.exe 29 PID 2104 wrote to memory of 3068 2104 hbnntt.exe 29 PID 2104 wrote to memory of 3068 2104 hbnntt.exe 29 PID 2104 wrote to memory of 3068 2104 hbnntt.exe 29 PID 3068 wrote to memory of 2160 3068 pjddp.exe 30 PID 3068 wrote to memory of 2160 3068 pjddp.exe 30 PID 3068 wrote to memory of 2160 3068 pjddp.exe 30 PID 3068 wrote to memory of 2160 3068 pjddp.exe 30 PID 2160 wrote to memory of 2736 2160 fxrflxl.exe 31 PID 2160 wrote to memory of 2736 2160 fxrflxl.exe 31 PID 2160 wrote to memory of 2736 2160 fxrflxl.exe 31 PID 2160 wrote to memory of 2736 2160 fxrflxl.exe 31 PID 2736 wrote to memory of 2768 2736 lffflxr.exe 32 PID 2736 wrote to memory of 2768 2736 lffflxr.exe 32 PID 2736 wrote to memory of 2768 2736 lffflxr.exe 32 PID 2736 wrote to memory of 2768 2736 lffflxr.exe 32 PID 2768 wrote to memory of 2792 2768 5thbhh.exe 33 PID 2768 wrote to memory of 2792 2768 5thbhh.exe 33 PID 2768 wrote to memory of 2792 2768 5thbhh.exe 33 PID 2768 wrote to memory of 2792 2768 5thbhh.exe 33 PID 2792 wrote to memory of 2752 2792 pjpvj.exe 34 PID 2792 wrote to memory of 2752 2792 pjpvj.exe 34 PID 2792 wrote to memory of 2752 2792 pjpvj.exe 34 PID 2792 wrote to memory of 2752 2792 pjpvj.exe 34 PID 2752 wrote to memory of 2692 2752 vvpjv.exe 35 PID 2752 wrote to memory of 2692 2752 vvpjv.exe 35 PID 2752 wrote to memory of 2692 2752 vvpjv.exe 35 PID 2752 wrote to memory of 2692 2752 vvpjv.exe 35 PID 2692 wrote to memory of 2548 2692 9rlrlrx.exe 36 PID 2692 wrote to memory of 2548 2692 9rlrlrx.exe 36 PID 2692 wrote to memory of 2548 2692 9rlrlrx.exe 36 PID 2692 wrote to memory of 2548 2692 9rlrlrx.exe 36 PID 2548 wrote to memory of 3028 2548 btnnhn.exe 37 PID 2548 wrote to memory of 3028 2548 btnnhn.exe 37 PID 2548 wrote to memory of 3028 2548 btnnhn.exe 37 PID 2548 wrote to memory of 3028 2548 btnnhn.exe 37 PID 3028 wrote to memory of 1228 3028 tnbbnt.exe 38 PID 3028 wrote to memory of 1228 3028 tnbbnt.exe 38 PID 3028 wrote to memory of 1228 3028 tnbbnt.exe 38 PID 3028 wrote to memory of 1228 3028 tnbbnt.exe 38 PID 1228 wrote to memory of 2784 1228 dvjvj.exe 39 PID 1228 wrote to memory of 2784 1228 dvjvj.exe 39 PID 1228 wrote to memory of 2784 1228 dvjvj.exe 39 PID 1228 wrote to memory of 2784 1228 dvjvj.exe 39 PID 2784 wrote to memory of 2860 2784 fffrxlx.exe 40 PID 2784 wrote to memory of 2860 2784 fffrxlx.exe 40 PID 2784 wrote to memory of 2860 2784 fffrxlx.exe 40 PID 2784 wrote to memory of 2860 2784 fffrxlx.exe 40 PID 2860 wrote to memory of 1572 2860 9xlrflx.exe 41 PID 2860 wrote to memory of 1572 2860 9xlrflx.exe 41 PID 2860 wrote to memory of 1572 2860 9xlrflx.exe 41 PID 2860 wrote to memory of 1572 2860 9xlrflx.exe 41 PID 1572 wrote to memory of 1952 1572 tnhtnb.exe 42 PID 1572 wrote to memory of 1952 1572 tnhtnb.exe 42 PID 1572 wrote to memory of 1952 1572 tnhtnb.exe 42 PID 1572 wrote to memory of 1952 1572 tnhtnb.exe 42 PID 1952 wrote to memory of 2428 1952 djjdj.exe 43 PID 1952 wrote to memory of 2428 1952 djjdj.exe 43 PID 1952 wrote to memory of 2428 1952 djjdj.exe 43 PID 1952 wrote to memory of 2428 1952 djjdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\hbnntt.exec:\hbnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pjddp.exec:\pjddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\fxrflxl.exec:\fxrflxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\lffflxr.exec:\lffflxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\5thbhh.exec:\5thbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\pjpvj.exec:\pjpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vvpjv.exec:\vvpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9rlrlrx.exec:\9rlrlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\btnnhn.exec:\btnnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\tnbbnt.exec:\tnbbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\dvjvj.exec:\dvjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\fffrxlx.exec:\fffrxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\9xlrflx.exec:\9xlrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\tnhtnb.exec:\tnhtnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\djjdj.exec:\djjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\ffrfxlf.exec:\ffrfxlf.exe17⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bnbnnb.exec:\bnbnnb.exe18⤵
- Executes dropped EXE
PID:1668 -
\??\c:\djppd.exec:\djppd.exe19⤵
- Executes dropped EXE
PID:776 -
\??\c:\ffxflrf.exec:\ffxflrf.exe20⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lflxxlr.exec:\lflxxlr.exe21⤵
- Executes dropped EXE
PID:1768 -
\??\c:\3ttbhh.exec:\3ttbhh.exe22⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pjdjp.exec:\pjdjp.exe23⤵
- Executes dropped EXE
PID:1248 -
\??\c:\ffxrfrf.exec:\ffxrfrf.exe24⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tnnbht.exec:\tnnbht.exe25⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hhhnth.exec:\hhhnth.exe26⤵
- Executes dropped EXE
PID:1844 -
\??\c:\1lxlxlx.exec:\1lxlxlx.exe27⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tnbhnt.exec:\tnbhnt.exe28⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dvpvp.exec:\dvpvp.exe29⤵
- Executes dropped EXE
PID:992 -
\??\c:\jjvvp.exec:\jjvvp.exe30⤵
- Executes dropped EXE
PID:1536 -
\??\c:\1rlrffr.exec:\1rlrffr.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bbhhtt.exec:\bbhhtt.exe32⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jpdvd.exec:\jpdvd.exe33⤵
- Executes dropped EXE
PID:1028 -
\??\c:\flfxrlr.exec:\flfxrlr.exe34⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bbhtnn.exec:\bbhtnn.exe35⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jddjj.exec:\jddjj.exe36⤵
- Executes dropped EXE
PID:836 -
\??\c:\rllxlxf.exec:\rllxlxf.exe37⤵
- Executes dropped EXE
PID:888 -
\??\c:\fffrxlx.exec:\fffrxlx.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bhbtnh.exec:\bhbtnh.exe39⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jppjj.exec:\jppjj.exe40⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rrfrxxl.exec:\rrfrxxl.exe41⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9bnnbh.exec:\9bnnbh.exe42⤵
- Executes dropped EXE
PID:1164 -
\??\c:\pdjvv.exec:\pdjvv.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\lfxrfxx.exec:\lfxrfxx.exe44⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ttnbnb.exec:\ttnbnb.exe45⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nnthbh.exec:\nnthbh.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vvvvj.exec:\vvvvj.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lffrxxf.exec:\lffrxxf.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbtnbh.exec:\hbtnbh.exe49⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tttntn.exec:\tttntn.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\djpdj.exec:\djpdj.exe51⤵
- Executes dropped EXE
PID:300 -
\??\c:\7flrllx.exec:\7flrllx.exe52⤵
- Executes dropped EXE
PID:2716 -
\??\c:\frxllrr.exec:\frxllrr.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bnnbtb.exec:\bnnbtb.exe54⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jjvdj.exec:\jjvdj.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dvvdj.exec:\dvvdj.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nbhhhn.exec:\nbhhhn.exe57⤵
- Executes dropped EXE
PID:2832 -
\??\c:\tbbnht.exec:\tbbnht.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jjvpv.exec:\jjvpv.exe59⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3rlffxf.exec:\3rlffxf.exe60⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rrllrff.exec:\rrllrff.exe61⤵
- Executes dropped EXE
PID:264 -
\??\c:\btbnbh.exec:\btbnbh.exe62⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1dpdp.exec:\1dpdp.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\vvvdj.exec:\vvvdj.exe64⤵
- Executes dropped EXE
PID:588 -
\??\c:\1rflxfl.exec:\1rflxfl.exe65⤵
- Executes dropped EXE
PID:1200 -
\??\c:\tnhnbt.exec:\tnhnbt.exe66⤵PID:1236
-
\??\c:\bthhtn.exec:\bthhtn.exe67⤵PID:2880
-
\??\c:\3ppdv.exec:\3ppdv.exe68⤵PID:2004
-
\??\c:\dvvdp.exec:\dvvdp.exe69⤵PID:1316
-
\??\c:\xxlfrxl.exec:\xxlfrxl.exe70⤵PID:2296
-
\??\c:\5lxfxfx.exec:\5lxfxfx.exe71⤵PID:2720
-
\??\c:\3bbtbn.exec:\3bbtbn.exe72⤵PID:1304
-
\??\c:\ppjpv.exec:\ppjpv.exe73⤵PID:2420
-
\??\c:\rlxrffr.exec:\rlxrffr.exe74⤵PID:2380
-
\??\c:\lfxlllx.exec:\lfxlllx.exe75⤵PID:2164
-
\??\c:\tnhtnn.exec:\tnhtnn.exe76⤵PID:284
-
\??\c:\pjvjd.exec:\pjvjd.exe77⤵PID:1852
-
\??\c:\xrflrxr.exec:\xrflrxr.exe78⤵PID:2008
-
\??\c:\xrflrxl.exec:\xrflrxl.exe79⤵PID:872
-
\??\c:\nnhtbb.exec:\nnhtbb.exe80⤵PID:2256
-
\??\c:\dvdvv.exec:\dvdvv.exe81⤵PID:2092
-
\??\c:\lfxrffx.exec:\lfxrffx.exe82⤵PID:3012
-
\??\c:\rrlfrfx.exec:\rrlfrfx.exe83⤵PID:540
-
\??\c:\bbtbht.exec:\bbtbht.exe84⤵PID:836
-
\??\c:\bhbnnb.exec:\bhbnnb.exe85⤵PID:2268
-
\??\c:\jjdpd.exec:\jjdpd.exe86⤵PID:2216
-
\??\c:\xfflrfr.exec:\xfflrfr.exe87⤵PID:1568
-
\??\c:\fffxfll.exec:\fffxfll.exe88⤵PID:3020
-
\??\c:\hbnhnt.exec:\hbnhnt.exe89⤵PID:2208
-
\??\c:\ddvdp.exec:\ddvdp.exe90⤵PID:2740
-
\??\c:\jdjdp.exec:\jdjdp.exe91⤵PID:2764
-
\??\c:\rllffll.exec:\rllffll.exe92⤵PID:2636
-
\??\c:\5tbhtb.exec:\5tbhtb.exe93⤵PID:1336
-
\??\c:\9bnbbb.exec:\9bnbbb.exe94⤵PID:2916
-
\??\c:\jjdpd.exec:\jjdpd.exe95⤵PID:2588
-
\??\c:\fxxfrfr.exec:\fxxfrfr.exe96⤵PID:2692
-
\??\c:\9frlxfx.exec:\9frlxfx.exe97⤵PID:2348
-
\??\c:\hhnbnb.exec:\hhnbnb.exe98⤵PID:2708
-
\??\c:\ddvdd.exec:\ddvdd.exe99⤵PID:2704
-
\??\c:\vpjpj.exec:\vpjpj.exe100⤵PID:2784
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe101⤵PID:2824
-
\??\c:\ttntnb.exec:\ttntnb.exe102⤵PID:1640
-
\??\c:\1hhbtb.exec:\1hhbtb.exe103⤵PID:1904
-
\??\c:\jjddv.exec:\jjddv.exe104⤵PID:1772
-
\??\c:\jdvdd.exec:\jdvdd.exe105⤵PID:1848
-
\??\c:\fffrffl.exec:\fffrffl.exe106⤵PID:1924
-
\??\c:\ttthht.exec:\ttthht.exe107⤵PID:2240
-
\??\c:\7pddd.exec:\7pddd.exe108⤵PID:776
-
\??\c:\jdvdp.exec:\jdvdp.exe109⤵PID:1576
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe110⤵PID:2900
-
\??\c:\bthbnn.exec:\bthbnn.exe111⤵PID:600
-
\??\c:\btnbhh.exec:\btnbhh.exe112⤵PID:2468
-
\??\c:\jjjpj.exec:\jjjpj.exe113⤵PID:1200
-
\??\c:\1lxlxxr.exec:\1lxlxxr.exe114⤵PID:2904
-
\??\c:\5rllrxf.exec:\5rllrxf.exe115⤵PID:1988
-
\??\c:\tnhtht.exec:\tnhtht.exe116⤵PID:2004
-
\??\c:\dvjjj.exec:\dvjjj.exe117⤵PID:3000
-
\??\c:\vvpdv.exec:\vvpdv.exe118⤵PID:2296
-
\??\c:\xrllfll.exec:\xrllfll.exe119⤵PID:1348
-
\??\c:\bthntn.exec:\bthntn.exe120⤵PID:2148
-
\??\c:\hthnhb.exec:\hthnhb.exe121⤵PID:1340
-
\??\c:\1pddp.exec:\1pddp.exe122⤵PID:2380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-